vpn-instance policy deny

Use vpn-instance policy deny to enter user role VPN instance policy view.

Use undo vpn-instance policy deny to restore the default user role VPN instance policy.

Syntax

vpn-instance policy deny

undo vpn-instance policy deny

Default

A user role has access to all VPN instances.

Views

User role view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

To restrict the VPN instance access of a user role to only a set of VPN instances, perform the following tasks:

1. Use vpn-instance policy deny to enter user role VPN instance policy view.

2. Use permit vpn-instance to specify accessible VPN instances.

   	NOTE: The vpn-instance policy deny command denies the access of the user role to all VPN instances if the permit vpn-instance command is not configured.

To configure a VPN instance, make sure the VPN instance is permitted by the user role VPN instance policy in use. You can perform the following tasks on an accessible VPN instance:

• Create, remove, or configure the VPN instance.

• Enter the VPN instance view.

• Specify the VPN instance in feature commands.

Any change to a user role VPN instance policy takes effect only on users who log in with the user role after the change.

Examples

# Enter user role VPN instance policy view of role1, and deny the access of user role role1 to all VPN instances.

<Sysname> system-view
[Sysname] role name role1
[Sysname-role-role1] vpn-instance policy deny
[Sysname-role-role1-vpnpolicy] quit

# Enter user role VPN instance policy view of role1, and deny the access of user role role1 to all VPN instances except vpn2.

<Sysname> system-view
[Sysname] role name role1
[Sysname-role-role1] vpn-instance policy deny
[Sysname-role-role1-vpnpolicy] permit vpn-instance vpn2

Related commands

display role

permit vpn-instance

role